This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About jeromecarrier
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About jeromecarrier
09-22-2023
36Posts
0Likes
0Solutions
Sep 22, 2023Last Visited
User
Activity
User
Profile
Latest posts by jeromecarrier
| Subject | Views | Posted |
|---|---|---|
| 658 | 04-01-2023 05:28 AM | |
| 548 | 03-06-2023 12:51 AM | |
| 575 | 03-03-2023 12:45 AM | |
| 595 | 03-02-2023 01:10 AM | |
| 2127 | 03-01-2023 07:50 AM | |
| 2152 | 02-28-2023 08:14 AM | |
| 2126 | 02-28-2023 07:03 AM | |
| 2153 | 02-26-2023 11:40 PM | |
| 3599 | 02-24-2023 08:51 AM | |
| 1183 | 12-03-2022 04:59 AM |
User Badges
Community Statistics
| Member Since | 10-04-2022 02:25 AM |
| Date Last Visited | 09-22-2023 10:16 AM |
| Posts | 36 |
04-01-2023
05:28 AM
Hello
I would like to have your support. I deployed the following architecture in Azure. We have only 1 VM-Series at the moment. Based on the PA document for Azure, I created a Private subnet in vNet Hub zone (similar as the transit zone in the PA documentation). I created DSI and Project vNet with peering with Hub vNeet. We deployed an Azure internal LB for traffic between DSI&Project and Private vNet. The Frontend IP is 10.110.0.21 and the backend is the VM-series interface eth1/2 (10.110.0.4). I created route table for DSI and Project vNet with a default route to the IP address of LB (10.110.0.21).It's working without issue. From On-prem, I'm able to contact the servers in these zones.
I added a new subnet (10.115.0.0/24) named "PrivateDMZ" in vNet Hub Zone and I created a new vNet "DMZ_PRIVATE" with peering with Hub Zone. I reproduced the same conf than before. I added entries in the Azure LB with Frondtend IP address 10.115.0.21 with backends the IP address of eth1/4 (10.115.0.4) I configured a route table for DMZ_PRIVATE vNet with a default route to 10.115.0.21. On VM-Series, I created virtual router dedicated for Private zone and another one for PrivateDMZ. I added the probe on each vr. All statics routes have been added (I checked many times). On the Azure Load Balancer, the health seems to be good without issue. But, from on-prem, when I try to contact server in DMZ, the connection is fail even if the traffic is allowed. In the log, the packet received is 0.
Do you know what is the issue and why it's not working ?
BR
Prive LB conf
... View more
03-06-2023
12:51 AM
Hi @aleksandar.astardzhiev
I'm not sure to understand your last comment. Currently, we have the following design. With this design, the DMZ zone is behind the private zone and it's curious for me to have a DMZ in a "private" zone.
My objective is to move the DMZ to avoid to route the traffic to the private zone to reach server in DMZ but all traffic from Internet or private zone or On-Prem to DMZ must be controlled by our VM-Series. I'm not sure if the bellow evolution is what did you said in your last past. On both VM-Series (who manager east-west and north-south traffic in the common firewall architecture), I add a new interface connected on the DMZ zone inside my vnet DSI_HUB. I create peer between vnet DMZ_Infra / DMZ_Project and the new DMZ zone and I add an LB on the zone (same approach than private zone). The UDR from On-premisses is changed for DMZ network to route the traffic to DMZ_LB.
What is you opinion ? Is-it correct ? Is-it not the better ?
... View more
03-03-2023
12:45 AM
Hi @aleksandar.astardzhiev
I would like to have your opinion. In the digram provided in my last post, if I need to create a DMZ for applications reachable from Internet, what is your recommandation regarding the network design ? To add a dedicated network card on my VM-Series (I can create 8 nic) dedicated for the DMZ and create the same approch than the private zone : a DMZ zone on the transit vnet with an LB (to be able to route the traffic an our 2 Vm-Series) ? Or juste create a new vnet and route the traffic to the current LB ( 10.110.0.21) but it's more difficule in this case to isolate the traffic between DMZ and the other vnet (App01, App02..) ?
... View more
03-02-2023
01:10 AM
Hi @aleksandar.astardzhiev
The picture sent is based on the "common firewall" architectecture and it's our configuration (we are not on configuration with East-West and North-South architecture).
Just to be sure : in this configuration based on on "common firewall" with the private LB (10.110.0.21), is-the traffic flow in red in the following picture is correct for traffic coming from On-premisses to App servers ?
... View more
03-01-2023
07:50 AM
Hi @aleksandar.astardzhiev
I would like to have your opinion. My architecture is similar than the below architecture provided by Palo Alto (without VPN gateway at the moment). But in the following configuration, if I understand, all traffic from On-Premisses network to App01 or App02 servers is not controled by the VM-Series (the default route from VPN Gateway is the private LB 10.110.0.21).
If I wan't to control all traffic from On-Premisses to our servers zones (10.112.0.0/16 or 10.113.0.0/16 VNet), I need to add 1 network interface on each VM-Series and add one LoadBalancer between or firewalls and the VPN Gateway ? So at the end, we will have 2 LB : 1xLB dedicated to the traffic between the Gateway and firewalls and 1xLB for the traffic between servers networks (10.112.0.0/16 or 10.113.0.0/16) and VM-Series firewall (10.110.0.4 & 10.110.0.5) ? Is-it correct ?
... View more
02-28-2023
08:14 AM
Hi @aleksandar.astardzhiev
Why I saided Lan(OnPrem) --> FW (OnPrem) -->Azure VPN Gateway --> AzureLB-->FW VM-Series-->VM, it's to control all traffic to/from our servers in Azure via the VM Series Palo Alto.
... View more
02-28-2023
07:03 AM
Hi @aleksandar.astardzhiev
Thank's for your comment. Regarding our VPN site 2 site between our on-prem and Azure, your recommandation is to create our VPN between our local site and the Azure VPN Gateway and forward the trafic to the Azure LB-->FW-->VM and not to create the VPN directly on the VM-Serie to avoid lost connection when I upgrade the first firewall in architecture with 2 VM-Series with LB ?
Regards
... View more
02-26-2023
11:40 PM
Hi
Thank you for your answer. So if I understand, the recommanded configuration is to deploy 2 VM-Series "standalone" (without HA configuration) and use Azure Load Balancer feature to route the trafic correctly on each firewall.
I plan to use our VM-Series in Azure with GlobalProtect to connect our users on the network with a vpn SSL. In this configuration, is-it possibleto provide a redundant solution to keep access to the newtwork even if a firewall reboots dûe to an upgrade version for example ? Or, if I restart FW1 for an upgrade version, all GlobalProtect SSL VPN connexions started on this firewall will be cut ? And what's happening for new connexion during the firewall reboots ?
Regards
... View more
02-24-2023
08:51 AM
Hello
I have currently 1 firewall VM-Series deployed on Azure. We plan to deploy a second for HA. My question is : is-it recommanded to configure the cluster in Active/Passive mode ? Or to configure the 2 VM-Series as active FW with Azure Load Balancer (what is the risk to have assymetric trafic) ?
Regards
Jerome
... View more
12-03-2022
04:59 AM
It's 2 individual firewall with azure LB in Frontend for inbound trafic to our internal Web servers.
But for VPN Ipsec HA, I don't see how to configure my 2 FW to keep the communication between our servers in Azure and our local site when I have one FW unavailable...
BR
... View more
11-29-2022
01:35 PM
Hello
We deploy 2 VM-Series on Azure as recommanded by PA. These 2 FW manage Inbound/Outbound traffic and between our internals zones. A public load balancer have been configured. We need to connect our Azure infrastructure with our local datacenter via IPsec VPN between PA on Azure and firewall on our datacenter.
Do you know if it's possible to configure an IPsec tunnel between our FW in datacenter and our 2 VM-Serie on Azure to avoid lost communication between Azure and datacenter when one of PA reboots?
Regards
Jérôme
... View more
11-23-2022
02:51 AM
Hello
These settings are already configured on my environment.
when I have a session open on my laptop with my domain account and my laptop connected on public wifi, when I start the GP program, the connexion is established without to be requested to enter my credentials on GP vpn client. For security reason, we want to force user to enter their credential each time that they want to connect the VPN on the network...
An idea?
BR
Jerome
... View more
11-22-2022
08:05 AM
Hello
I have not found the option to force to enter user credentials each time in Network > GlobalProtect > Portals > [edit] > Agent > Configs > [edit] > Authentication... 😞
... View more
11-18-2022
08:01 AM
Hello
I discover GP so I'm sorry, in advance, if my questions are stupide.
Q1 : How I can force my users to enter their credentials (OnPrem AD or Azure AD depending the auth profile configured) when they start GP protect ? I don't want to use SSO and I want that my user enter their credential each time that they want to start the VPN connexion.
Q2 : Is-it possible to configure the GP client with the Gateway server by default (without the possibilty to remove it by user or to add another one) ? The objective is when I deploy the client on the computer via SCCM or when user open a session on the portal to download the vpn client, the client is already "pre-configured" with our settings and user does not have to enter gateway information, just click "connect".... 🙂
BR
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-22-2023
10:16 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks